{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Windows XP Professional x64 Edition Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows XP Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2003 pour syst\u00e8mes Itanium (SP1 et SP2).","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows XP Professional x64 Edition ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2003 x64 Edition Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2003 Service Pack 1 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2003 x64 Edition ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Windows Server 2003 Service Pack 2 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}},{"description":"Microsoft Windows 2000 Service Pack 4 ;","product":{"name":"Windows","vendor":{"name":"Microsoft","scada":false}}}],"affected_systems_content":null,"content":"## Description\n\nLe service LSASS de Microsoft Windows (Local Security Authority\nSubsystem Service) ne manipulerait pas correctement certaines requ\u00eates\nd'appel LPC (Local Procedure Call). Un utilisateur local pourrait ainsi\nprofiter de cette vuln\u00e9rabilit\u00e9 pour \u00e9lever ses privil\u00e8ges et ex\u00e9cuter\ndu code avec des droits plus \u00e9lev\u00e9s que ceux qui lui ont \u00e9t\u00e9 attribu\u00e9s.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS08-002 de Microsoft pour\nl'obtention des correctifs (cf. section Documentation).\n","cves":[{"name":"CVE-2007-5352","url":"https://www.cve.org/CVERecord?id=CVE-2007-5352"}],"links":[],"reference":"CERTA-2008-AVI-010","revisions":[{"description":"version initiale.","revision_date":"2008-01-09T00:00:00.000000"}],"risks":[{"description":"Ex\u00e9cution de code arbitraire"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"\u00c9l\u00e9vation de privil\u00e8ges"}],"summary":"Le service LSASS de Microsoft Windows (<span class=\"textit\">Local\nSecurity Authority Subsystem Service</span>) ne manipulerait pas\ncorrectement certaines requ\u00eates d'appel LPC (<span class=\"textit\">Local\nProcedure Call</span>). Un utilisateur local pourrait ainsi profiter de\ncette vuln\u00e9rabilit\u00e9 pour \u00e9lever ses privil\u00e8ges et ex\u00e9cuter du code avec\ndes droits plus \u00e9lev\u00e9s que ceux qui lui ont \u00e9t\u00e9 attribu\u00e9s.\n","title":"Vuln\u00e9rabilit\u00e9 dans LSASS de Windows","vendor_advisories":[{"published_at":null,"title":"Bulletin de s\u00e9curit\u00e9 Microsoft MS08-002 du 08 janvier 2008","url":"http://www.microsoft.com/technet/security/Bulletin/MS08-002.mspx"}]}